This Privacy Policy describes how Crosshair Labs ("we", "us", or "our") collects, uses, shares and protects your personal information when you use the Sheldon AI app and website (together, "the App"). It is written to meet our obligations under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA), and it explains the rights you have under that Act. If you are in the European Economic Area or the United Kingdom, section 11 sets out the additional rights you have; if you are in California, see section 12.
This policy forms part of our Terms and Conditions. By using the App you agree to the collection and use of information as described here.
We will never ask for your exchange withdrawal permissions, your wallet seed phrase or your private keys. If anyone claiming to be from Sheldon AI asks you for these, it is a scam — do not respond, and tell us.
We use your personal information only for the purposes below, each of which is either necessary to provide the service you asked for, required by law, or a legitimate interest that does not override your rights.
| What we do | Why |
|---|---|
| Provide signals, AI chat, charts, the journal and notifications | To perform our contract with you |
| Verify your subscription and apply fair-use limits | To perform our contract with you |
| Confirm your exchange UID and calculate volume rewards | To perform our contract with you |
| Send account, security and service messages | To perform our contract with you |
| Improve the App, diagnose faults and keep it secure | Our legitimate interest in a working, safe product |
| Prevent fraud, abuse and account sharing | Our legitimate interest, and protecting other users |
| Keep a record of the terms you signed | Our legal obligation and legitimate interest in evidence of agreement |
| Send marketing or promotional messages | Only with your consent, which you can withdraw at any time |
We do not use your personal information to make any decision about you by purely automated means that has a legal or similarly significant effect. Signals are generated from market data, not from your personal information.
We do not sell, rent or trade your personal information, and we do not share it with third parties for their own marketing. We share it only with the service providers we need to run the App, each of which is bound to protect it and use it only on our instructions:
| Provider | What they handle |
|---|---|
| Supabase (hosted on AWS) | Database, authentication and file storage — your account, journal, signals and records |
| Netlify | Website and backend function hosting |
| Anthropic | The AI behind Sheldon Chat and chart analysis — receives the message or screenshot you submit |
| Voyage AI | Converts trading knowledge into a searchable form so answers can be grounded in the methodology |
| Google Firebase and Apple | Delivery of push notifications to your device |
| Paystack, Apple, Google | Subscription payments and billing |
| Cryptocurrency exchanges | Market data, and — only if you connect your own account — your own trade instructions |
| Our exchange referral partner | Confirms your exchange UID and returns your trading volume totals for rewards |
| Cloudflare | Network protection and the secured tunnel our market-data relay runs through |
We may also disclose personal information where the law requires it, to respond to a lawful request from an authority, to establish or defend a legal claim, to protect the rights and safety of our users or ourselves, or to a successor if the business is sold or merged — in which case this policy continues to apply to the information transferred.
Connecting an exchange account is optional. The App works fully without it. If you do connect one:
Because a key is sensitive, treat it as you would a password: do not reuse it across services, and revoke it if you suspect your device has been compromised.
Your data is stored with Supabase on AWS infrastructure. All traffic between your device and our servers is encrypted in transit using HTTPS/TLS. Passwords are hashed. Access to production data is restricted, and sensitive records are reachable only through server-side endpoints rather than from the app itself.
No system is perfectly secure. We cannot guarantee the security of information transmitted over the internet, and you are responsible for keeping your own password, device and exchange credentials safe. If we become aware of a breach that creates a risk to you, we will notify you and the Information Regulator as POPIA requires.
When you delete your account we remove your personal data, other than records we are required or entitled to retain as described above. Deletion requests are processed within 30 days.
We are based in South Africa, but several providers above process data outside it, including in the European Union and the United States. Where your information is transferred across a border, we rely on providers that are subject to laws or binding agreements offering a level of protection comparable to POPIA, and we require them by contract to protect it and use it only for the purpose we engaged them for.
The App uses browser storage and cookies for things it cannot work without: keeping you signed in, remembering your settings and preferred exchange, and applying fair-use limits. We do not use advertising cookies and we do not run third-party ad trackers.
Our hosting and network providers may set operational cookies for security and load balancing. You can clear or block storage in your browser settings, but the App will not function correctly without it — you will be signed out and your preferences lost.
The App is for adults. It is not intended for anyone under 18 and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
As a data subject in South Africa you have the right to:
To exercise any of these, contact us using the details in section 13. We may ask you to confirm your identity first so we do not disclose your information to someone else. We will respond within the period POPIA allows.
In addition to the rights above, you may request that we restrict processing, and you may request a machine-readable copy of the information you provided to us so you can transfer it to another provider. Where we rely on legitimate interests, you may object and we will stop unless we have compelling grounds that override your rights. You may complain to your local data protection authority.
You may request details of the categories of personal information we have collected about you, the purposes we used it for and the categories of third parties we disclosed it to, and you may request deletion. We do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising these rights — your access, price and service quality stay the same.
For any privacy question, to exercise a right, or to report a concern:
If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.
Sheldon AI provides trading signals and analysis for educational and informational purposes only. Nothing in the App is financial advice, investment advice, or a recommendation to buy or sell any asset. Signals are generated automatically by an artificial-intelligence system and are not the personal trades of any individual. Trading cryptocurrency carries significant risk and you may lose some or all of your capital. You are solely responsible for your own trading decisions. Our full Terms and Conditions are available in the App.
We may update this policy from time to time. We will post the updated version on this page with a new date, and where a change is significant we will tell you in the App. Continued use after a change means you accept the updated policy.
© 2026 Crosshair Labs. All rights reserved.